Who is a maintainer of an Open Source project?

Who thinks they have good security practice of their project?

We are here to help

• Part of the Linux Foundation
• Focus on Open Source Security
• Not for Profit
• Security newsletters and blog
• Free courses:
  • Secure Software Development Fundamentals
  • Securing Your Software Supply Chain with Sigstore
• OpenSSF Day (OSS EU)
  • 18th Spet Bilbao

• Created and maintained by the OpenSSF community
• help open source maintainers
  • improve their security best practices
• help open source consumers
  • judge whether their dependencies are safe
• automated tool  - run checks
  • Scorecard GitHub Action
  • Scorecard REST API
  • Scorecard Badges

• Is the project free of checked-in binaries?
• Does the project use Branch Protection ?
• Does the project run tests in CI?
• Does the project practice code review before code is merged?
• Does the project use tools to help update its dependencies?
• Is the project at least 90 days old, and maintained?

Full list: github.com/ossf/scorecard#scorecard-checks

Checks includes

Talk to me if you wanna know more

(I got stickers 🌈)

Grab this slides: slides.com/cheukting_ho/openssf-scorecard